SubHeadsUp — Privacy Policy
Last updated: April 2026
SubHeadsUp is built on a simple idea: your subscriptions should be visible to you, not invisible to your bank account. To do that job well, we need access to your Gmail — and we know that's a big ask. This policy explains exactly what we do with that access, what we store, and what rights you have. No legalese, no small print games.
SubHeadsUp is operated by Serpin Ltd, a UK-registered company. This policy complies with the UK GDPR and Data Protection Act 2018.
When you sign in with Google, we receive your name and email address via Firebase Authentication. We use this to create and identify your account. Nothing else is pulled from your Google profile.
We request read-only access to your Gmail account. This is the core of what SubHeadsUp does — but we want to be precise about what "access" actually means here:
We do not read your emails. We scan subject lines and sender addresses against a list of known subscription providers (services like Netflix, Spotify, Adobe, and so on). If there's a match, we extract only the subscription-relevant details: the provider name, the renewal date, and the billing amount where it appears in the subject line. The body content of your emails is never read, stored, or processed.
Your Gmail access token is stored securely and used solely for this scanning purpose. It is never used for anything else.
Once we identify a subscription from your inbox, we store:
This is the data that powers your dashboard and your weekly digest.
We store your in-app settings — things like notification preferences and digest timing — so your experience is consistent across sessions.
| Purpose | Legal basis |
|---|---|
| Providing the service (scanning Gmail, building your subscription list) | Contract performance |
| Sending your weekly digest email | Contract performance |
| Sending account and service emails (confirmations, important updates) | Contract performance |
| Improving the app during beta | Legitimate interests |
| Complying with legal obligations | Legal obligation |
We use Resend to send emails from hello@subheadsup.com. Resend processes your email address solely to deliver messages on our behalf.
Your account and subscription data is stored in a PostgreSQL database hosted on Neon, with servers located in the EU. Your Google OAuth token is stored securely within this same environment.
We do not transfer your personal data outside the UK or EEA in ways that would reduce your protections under UK GDPR.
Nobody, for commercial purposes. We do not sell your data. We do not use your data for advertising. We do not share your subscription list with any third party.
We work with a small number of service providers who help us operate SubHeadsUp:
These providers act as data processors under UK GDPR, meaning they only process your data on our instructions and are bound by appropriate data protection agreements.
Under UK GDPR, you have the following rights — and we've made them practical, not just theoretical.
Right to delete. You can delete your account and all associated data at any time from your account settings. Deletion is permanent and complete.
Right to revoke Gmail access. You can disconnect SubHeadsUp's Gmail access at any time via your [Google Account security settings](https://myaccount.google.com/permissions). When you do, we stop scanning. Any subscription data we've already identified stays in your account until you delete it or your account.
Right to export. You can export your subscription data in a portable format from your account settings.
Right to access. You can request a copy of all personal data we hold about you by emailing hello@subheadsup.com.
Right to rectification. If any data we hold about you is inaccurate, you can correct it or ask us to.
Right to object or restrict processing. You can ask us to stop or limit processing your data in certain circumstances. Where we're relying on legitimate interests, you have an absolute right to object.
Right to opt out of emails. Every digest email and marketing communication includes an unsubscribe link. You can also manage email preferences in your account settings.
To exercise any of these rights, email us at hello@subheadsup.com. We'll respond within 30 days.
We keep your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days — except where we're required to retain certain records for legal or accounting purposes (typically up to 6 years, for financial records only).
SubHeadsUp is currently in beta. This means:
We use only the cookies necessary to keep you signed in. We do not use advertising cookies, tracking pixels, or third-party analytics that profile your behaviour across other websites.
SubHeadsUp is not intended for users under 16. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, please contact us and we will delete it promptly.
If we make significant changes to this policy, we'll email you at least 14 days before the changes take effect, so you can review them and, if you disagree, delete your account before they apply.
Minor clarifications (fixing typos, adding detail without changing substance) may be made without notice, but the "last updated" date at the top will always reflect the most recent revision.
Serpin Ltd
Email: hello@subheadsup.com
If you're unhappy with how we've handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:
We'd always prefer to resolve concerns directly first — please do reach out to us before escalating.
If you join the beta waitlist on subheadsup.com, we collect one thing: the email address you give us. We use it to send you your beta invite and occasional updates about the beta, nothing else. It is stored securely in our database and is not shared with anyone. The lawful basis is your consent, and you can withdraw it any time: email hello@subheadsup.com and we will delete you from the list.
The landing page sets no cookies and runs no analytics trackers.